In a managed information environment, users typically access a mass storage subsystem, such as one or more databases (DBs) for various data items used in the normal course of business operations. Often, it is desirable to monitor and oversee transactions occurring with respect to data base access. Monitoring of the databases access transactions can identify potential security breaches, inappropriate usage of sensitive information, track usage trends to assist with resource planning and accounting chargebacks, and provide continuous tracking of access to sensitive data for government mandated auditing and regulatory compliance.
Database transaction tracking and monitoring may occur at the system level, as users attempt to gain access, or at the data level, as types of data sought for access are scrutinized. Data level security provides more specific control and recognition over data access, as database transactions are qualitatively analyzed, rather then permitting unconstrained access over large portions typically afforded by privilege and access based mechanisms. However, conventional data level security reporting mechanisms typically coexist with database server applications on a target machine. Therefore, these mechanisms impose additional processes or threads on the target machine. The additional processes or threads tend to consume computational resources of the target machine, slowing overall response. Such conventional mechanisms are typically required to receive and examine every database access attempt, further impeding database performance.
Accordingly, some systems employ nonintrusive data level database access monitoring techniques. Nonintrusive access monitoring resides in a separate computing device in communication with an access path, such as an Ethernet cable or other network access path, between the users and the database server. Such nonintrusive devices observe database access requests (transactions) in a passive manner during transport from the user to the database server. Accordingly, a database monitor device intercepts, or “sniffs” these transactions “over the wire,” in a nonintrusive manner to gather the database transactional data via an offloaded processor which does not impede database access or compete with database servers for available CPU cycles.